Use defproperty to define DoubleCheck properties in a file, then call
check-properties at the end to display the results. This opens a GUI
displaying results, including success, failure, and the values of randomly
chosen variables.

Each defproperty form defines a property called name which
states that test must be true for all assignments to each var
in the bindings. DoubleCheck attempts to run the test repeat times
(default 50), but limits the attempts to generate satisfactory random data to
limit times (default 2500).

Dracula generates values for each var by running random-expr,
which defaults to (random-sexp). The var is generated until
hypothesis-expr evaluates to true (non-nil), or limit
attempts have been made (defaulting to the property’s limit, defaulting
to 50 as noted above).

ACL2 evaluates each defproperty as a theorem (defthm)
equivalent to:

(defthmname(implies(andhypothesis-expr...)test)theorem-option...)

Here are some examples to illustrate the translation from theorems to
DoubleCheck properties.

Example 1:

(include-book"doublecheck":dir:teachpacks)

; This theorem has no hypotheses.

(defthmacl2-count-cons-theorem

(>(acl2-count(consab))(+(acl2-counta)(acl2-countb))))

; The corresponding defproperty lists the free variables.

(defpropertyacl2-count-cons-property

(ab)

(>(acl2-count(consab))(+(acl2-counta)(acl2-countb))))

(check-properties)

Example 2:

(include-book"doublecheck":dir:teachpacks)

; This theorem needs some hypotheses.

(defthmrationalp-/-theorem

(implies(and(integerpx)(pospy))

(rationalp(/xy))))

; DoubleCheck expresses these as :where clauses.

(defpropertyrationalp-/-property

(x:where(integerpx)

y:where(pospy))

(rationalp(/xy)))

(check-properties)

Example 3:

(include-book"doublecheck":dir:teachpacks)

; These hypotheses state a relationship between variables.

(defthmmember-equal-nth-theorem

(implies(and(proper-consplst)

(natpidx)

(<idx(lenlst)))

(member-equal(nthidxlst)lst))

:rule-classes(:rewrite:forward-chaining))

; We can help DoubleCheck by picking random distributions

; that are likely to satisfy the hypotheses.

(defpropertymember-equal-nth-property

(lst:where(proper-consplst)

:value(random-list-of(random-sexp))

idx:where(and(natpidx)(<idx(lenlst)))

:value(random-between0(1-(lenlst))))

(member-equal(nthidxlst)lst)

:rule-classes(:rewrite:forward-chaining))

(check-properties)

2.4.2Random Distributions

Randomness is an inherently imperative process. As such, it is not reflected in
the logic of ACL2. The random distribution functions of DoubleCheck may only be
used within :value clauses of defproperty, or in other random
distributions.

(random-sexp)→t

(random-atom)→atom

(random-boolean)→booleanp

(random-symbol)→symbolp

(random-char)→characterp

(random-string)→stringp

(random-number)→acl2-numberp

(random-rational)→rationalp

(random-integer)→integerp

(random-natural)→natp

These distributions produce random elements of the builtin Dracula types. When
no distribution is given for a property binding, defproperty uses
random-sexp by default.

(random-betweenlohi)→integerp

lo:integerp

hi:integerp

Produces an integer uniformly distributed between lo and hi,
inclusive; lo must be less than or equal to hi.

(random-data-size)→natp

Produces a natural number weighted to prefer small numbers, appropriate for
limiting the size of randomly produced values. This is the default distribution
for the length of random lists and the size of random s-expressions.

(random-element-oflst)→t

lst:proper-consp

Chooses among the elements of lst, distributed uniformly.

(random-list-ofexprmaybe-size)

maybe-size

=

|

:sizesize

Constructs a random list of length size (default
(random-data-size)), each of whose elements is the result of evaluating
expr.

(random-sexp-ofexprmaybe-size)

maybe-size

=

|

:sizesize

Constructs a random cons-tree with size total
cons-pairs (default (random-data-size)), each of whose leaves
is the result of evaluating expr.

(defrandomname(arg...)body)

The defrandom form defines new random distributions. It takes the same
form as defun, but the body may refer to other random distributions.

Example:

; Construct a distribution for random association lists:

(defrandomrandom-alist(len)

(random-list-of(cons(random-atom)(random-sexp)):sizelen))

; ...and now use it:

(defpropertyacons-preserves-alistp

(alist:where(alistpalist):value(random-alist(random-between010))

key:where(atomkey):value(random-atom)

datum)

(alistp(aconskeydatumalist)))

(random-caseclause...)

clause

=

expr

|

expr:weightweight

Chooses an expression from the clauses, each with the associated weight
(defaulting to 1), and yields its result; the other expressions are not
evaluated. This is useful with defrandom for defining recursive
distributions.

Be careful of the branching factor; a distribution with a high probability of
unbounded recursion is often unlikely to terminate. It is useful to give a
depth parameter to limit recursion.